MANAGEMENT  CONTROL  PROGRAM  AT 
DEFENSE  INFORMATION  SYSTEMS  AGENCY, 
WESTERN  HEMISPHERE 


Report  No.  95-280 


July  26,  1995 


2000010/  094 


Department  of  Defense 

distribution  statement  a 

Approved  for  Public  Release 
Distribution  Unlimited 


Additional  Copies 


To  obtain  additional  copies  of  this  audit  report,  contact  the  Secondary  Reports  Distribution 
Unit,  Audit  Planning  and  Technical  Support  Directorate,  at  (703)  604-8937 
(DSN  664-8937)  or  FAX  (703)  604-8932. 

Suggestions  for  Future  Audits 

To  suggest  ideas  for  or  to  request  future  audits,  contact  the  Planning  and  Coordination 
Branch,  Audit  Planning  and  Technical  Support  Directorate,  at  (703)  604-8939 
(DSN  664-8939)  or  FAX  (703)  604-8932.  Ideas  and  requests  can  also  be  mailed  to: 

Inspector  General,  Department  of  Defense 
OAIG-AUD  (ATTN:  APTS  Audit  Suggestions) 

400  Army  Navy  Drive  (Room  801) 

Arlington,  Virginia  22202-2884 

Defense  Hotline 

To  report  fraud,  waste,  or  abuse,  contact  the  Defense  Hotline  by  calling  (800)  424-9098;  by 
sending  an  electronic  message  to  Hotline@DODIG.OSD.MIL;  or  by  writing  the  Defense 
Hotline,  The  Pentagon,  Washington,  D.C.  20301-1900.  The  identity  of  each  writer  and 
caller  is  fully  protected. 


Acronyms 

DFAS  Defense  Finance  and  Accounting  Service 

DISA  Defense  Information  Systems  Agency 

DISA  WESTHEM  DISA  Western  Hemisphere 
KAR  Key  Accounting  Requirement 


INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-2884 


July  26,  1995 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE 

DIRECTOR,  DEFENSE  INFORMATION  SYSTEMS 
AGENCY 

SUBJECT :  Audit  Report  on  the  Management  Control  Program  at  Defense  Information 
Systems  Agency,  Western  Hemisphere  (Report  No.  95-280) 


We  are  providing  this  audit  report  for  review  and  comment.  This  report 
resulted  from  our  Audit  of  the  Defense  Business  Operations  Fund-Defense  Information 
Services  Organization  Financial  Statements  for  FY  1994,  Report  No.  95-209.  We 
considered  management  comments  on  a  draft  of  this  report  in  preparing  the  final 
report. 


DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly. 
As  requested  by  management,  we  added  a  DoD  regulation  to  Recommendation  2. a. 
The  Defense  Finance  and  Accounting  Service  comments  on  the  draft  of  this  report 
conformed  to  the  requirements  of  DoD  Directive  7650.3  and  left  no  unresolved  issues. 
The  Defense  Information  Systems  Agency  Western  Hemisphere  did  not  provide 
comments.  We  request  that  the  Defense  Information  Systems  Agency,  Western 
Hemisphere  provide  comments  by  August  28,  1995. 

Questions  on  the  audit  should  be  directed  to  Ms.  Mary  Lu  Ugone,  Audit 
Program  Director,  at  (703)  604-9529  (DSN  664-9529)  or  Mr.  John  M.  Donnelly, 
Audit  Project  Manager,  at  (703)  604-9549  (DSN  664-9549).  See  Appendix  K  for  the 
report  distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 

David  K.  Steensma 
Deputy  Assistant  Inspector  General 
for  Auditing 
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Management  Control  Program  at 
Defense  Information  Systems  Agency,  Western  Hemisphere 


Executive  Summary 


Introduction.  This  report  resulted  from  the  Audit  of  the  Defense  Business  Operations 
Fund-Defense  Information  Services  Organization  Financial  Statements  for  FY  1994 
(Report  No.  95-209,  May  31,  1995).  In  September  1994,  the  Director,  Defense 
Information  Systems  Agency,  realigned  the  Defense  Information  Services  Organization 
and  renamed  it  the  Defense  Information  Systems  Agency,  Western  Hemisphere  (DISA 
WESTHEM).  The  DISA  WESTHEM  consists  of  a  headquarters  office  and  16  Defense 
megacenters.  Its  mission  is  to  provide  information  processing  support  to  the  DoD 
Components.  The  DISA  WESTHEM  FY  1994  customer  revenues  totaled 
$508  million. 

Objectives.  The  overall  audit  objective  was  to  evaluate  the  adequacy  of  the  DISA 
WESTHEM  FY  1994  management  control  program.  We  also  evaluated  the 
effectiveness  of  the  Defense  Finance  and  Accounting  Service  (DFAS)  annual  reviews 
of  accounting  systems  used  to  process  and  prepare  DISA  WESTHEM  FY  1994 
financial  statements. 

Audit  Results.  The  DISA  WESTHEM  and  DFAS  did  not  adequately  review 
accounting  system  controls  as  required  by  DoD  Directive  5010.38,  "Internal 
Management  Control  Program,"  April  14,  1987.  As  a  result,  DFAS  and  DISA 
WESTHEM  annual  reviews  of  accounting  systems  cannot  be  relied  on  to  verify  the 
adequacy  of  accounting  system  controls  needed  to  ensure  the  accuracy,  completeness, 
and  reliability  of  DISA  WESTHEM  financial  statements  for  FY  1994. 
Recommendations  in  the  report,  if  implemented,  will  improve  the  reliability,  accuracy, 
and  usefulness  of  annual  reviews  (see  Appendix  I). 

The  DISA  WESTHEM  also  had  weaknesses  in  its  management  control  program  not 
related  to  accounting  system  controls.  The  DISA  WESTHEM  planned  or  implemented 
actions  to  correct  the  weaknesses  during  the  audit  (see  Appendix  C). 

Summary  of  Recommendations.  We  recommend  that  DFAS  and  DISA  WESTHEM 
establish  a  memorandum  of  agreement  to  coordinate  annual  reviews  of  accounting 
system  controls  to  include  specifying  responsibilities  for  the  DFAS  system  manager  and 
DISA  WESTHEM  system  user;  train  system  managers  and  users  in  performing  annual 
reviews  of  accounting  system  controls;  document  accounting  system  controls  and 
related  control  testing  during  the  reviews;  and  consider  the  results  of  related  audits  and 
evaluations  in  performing  annual  reviews. 

Management  Comments.  Although  DFAS  nonconcured  with  the  recommendation  to 
establish  a  memorandum  of  agreement  to  coordinate  annual  reviews  with  DISA 
WESTHEM,  DFAS  agreed  to  require  selected  users  of  DoD  accounting  systems  to 
participate  in  annual  reviews  and  will  advise  appropriate  DFAS  centers  of  the 
requirement. 

\ 

I 


The  DFAS  partially  concurred  with  the  recommendation  to  provide  training  to  system 
managers  and  users.  The  DFAS  stated  that  it  would  supplement  an  existing  training 
program  by  providing  guidance  and  points  of  contact  to  system  managers  and  selected 
system  users  on  the  conduct  of  annual  reviews.  Also,  DFAS  requested  that  we  add  a 
DoD  regulation  to  the  recommendation  on  training. 

The  DFAS  concurred  with  recommendations  to  document  accounting  controls  and 
related  control  testing  and  to  consider  related  audits  and  other  evaluations  when 
performing  annual  reviews.  Managers  will  document  specific  annual  review  guide 
questions  and  consider  applicable  audit  findings  and  recommendations  when  performing 
annual  accounting  system  reviews. 

The  DFAS  comments  related  to  all  DoD  accounting  systems,  not  just  the  three 
accounting  systems  in  the  audit  scope  (Appendix  A).  A  discussion  of  the  comments  is 
in  Part  I  of  the  report,  and  the  complete  text  of  the  comments  is  in  Part  HI. 

Audit  Response.  The  DFAS  comments  were  fully  responsive  to  recommendations. 
The  DFAS  planned  and  completed  actions  concerning  system  manager  and  user  training 
satisfy  the  intent  of  the  recommendation.  Although  DFAS  nonconcured  with  the 
recommendation  to  coordinate  annual  reviews,  DFAS  provided  acceptable  alternative 
actions  to  ensure  user  participation  in  annual  accounting  system  reviews.  In  response 
to  the  DFAS  request,  we  added  the  DoD  regulation  to  the  recommendation  on  training. 

The  DISA  WESTHEM  did  not  provide  comments.  Therefore,  we  request  that  DISA 
WESTHEM  provide  comments  by  August  28,  1995. 
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Part  I  -  Audit  Results 


Audit  Results 


Audit  Background 


On  September  1,  1994,  the  Director,  Defense  Information  Systems  Agency 
(DISA),  realigned  the  Defense  Information  Services  Organization  and  renamed 
it  DISA  Western  Hemisphere  (DISA  WESTHEM).  As  a  part  of  the  Defense 
Business  Operations  Fund-Information  Processing  Business  Area,  DISA 
WESTHEM  mission  is  to  provide,  at  competitive  prices,  information  products 
and  services  that  enable  DoD  Components  to  accomplish  their  missions.  The 
DISA  WESTHEM  consists  of  a  headquarters  office  and  16  Defense 
megacenters.  The  DISA  WESTHEM  employs  about  6,000  military  and  civilian 
personnel.  For  FY  1994,  DISA  WESTHEM  sales  of  information  products 
totaled  $508  million.  Our  audit  focused  on  the  management  control  program 
for  the  accounting  systems  at  DISA  WESTHEM  and  on  the  annual  reviews  of 
those  systems. 

DoD,  Federal,  and  Statutory  Requirements  Related  to  Accounting  System 
Controls.  DoD  Directive  5010.38,  "Internal  Management  Control  Program," 
April  14,  1987  (the  Directive),  implements  requirements  in  Office  of 
Management  and  Budget  Circular  A-123,  "Internal  Control  Systems,"  August  4, 
1986.  The  Directive  provides  policy,  prescribes  procedures,  and  assigns 
responsibilities  for  DoD  Components'  management  control  programs.  The 
Directive  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
management  controls  to  provide  reasonable  assurance  that  assets  are  used 
properly  and  that  programs  are  efficiently  and  effectively  managed.  The 
Directive  also  requires  a  review  of  management  controls  that  are  an  integral  part 
of  an  accounting  system  for  compliance  with  accounting  principles,  standards, 
and  related  requirements  established  by  the  General  Accounting  Office  and  the 
Office  of  Management  and  Budget.  The  Directive  states  that  specific  DoD 
policies  for  evaluating  accounting  systems  are  in  DoD  Manual  7220.9-M, 
"Department  of  Defense  Accounting  Manual,"  chapter  12,  October  1983. 
DoD  7000. 14-R,  "Financial  Management  Regulation"  (the  Regulation), 
volume  I,  chapter  3,  May  1993,  superseded  chapter  12  of  the  DoD  Accounting 
Manual. 

The  Regulation  implements  the  statutory  and  Office  of  Management  and  Budget 
requirement  to  review  accounting  systems  and  to  report  to  Congress  and  die 
President  on  whether  the  systems  comply  with  Comptroller  General  standards. 
The  Regulation  states  that  die  annual  report  will  be  based  on  annual  reviews  of 
accounting  system  controls  conducted  by  system  managers  and  users  and  on 
detailed  cyclical  evaluations  of  accounting  system  controls  conducted  by  an 
independent  Defense  Finance  and  Accounting  Service  (DFAS)  review  team. 

Definition  of  an  Accounting  System.  An  accounting  system  is  the 
structure  of  methods  and  procedures  used  to  record,  classify,  accumulate, 
analyze,  summarize,  and  report  information  on  the  financial  condition  and 
operating  position  of  an  organization.  As  defined  in  the  Regulation,  accounting 
systems: 
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o  consist  of  the  various  functional  operations  involved  in  authorizing, 
recording,  classifying,  analyzing,  and  reporting  financial  information  related  to 
financing  sources,  gains,  expenses,  losses,  transfers,  assets,  liabilities,  equity, 
and  management  controls;  and, 

o  encompass  the  procedures  and  processes  from  the  time  at  which  a 
transaction  is  authorized;  through  processing  of  the  data,  either  manually  or 
automatically;  to  issuance  of  financial  and  management  information  statements 
and  reports. 


The  accounting  systems  DISA  WESTHEM  used  for  processing  and  reporting  its 
FY  1994  financial  information  are  discussed  in  Appendix  D. 

Management  Control  Objectives.  The  objectives  of  management 
controls,  as  prescribed  by  the  Directive,  are  to  provide  management  with 
reasonable  assurance  that: 

o  obligations  and  costs  comply  with  applicable  law; 

o  assets  are  safeguarded  against  waste,  loss,  unauthorized  use,  and 
misappropriation; 

o  revenues  and  expenditures  applicable  to  agency  operations  are 
recorded  and  accounted  for  properly  so  that  accounts  and  reliable  financial  and 
statistical  reports  may  be  prepared  and  accountability  of  the  assets  may  be 
maintained;  and 

o  programs  are  efficiently  and  effectively  carried  out  in  accordance  with 
applicable  law  and  management  policy. 

Accounting  System  Review  Process.  The  Regulation  discusses  two  types  of 
reviews  performed  as  part  of  the  accounting  system  review  process:  annual 
reviews  and  cyclical  reviews.  The  Regulation  specifies  13  key  accounting 
requirements  with  which  accounting  systems  must  comply.  The  accounting 
requirements  are  a  composite  of  requirements  of  the  General  Accounting  Office, 
Office  of  Management  and  Budget,  Department  of  the  Treasury,  and  DoD.  The 
Regulation  states  that  system  managers  will  conduct  annual  reviews  of 
accounting  systems  and  that  DFAS  evaluation  teams  will  perform  cyclical 
reviews  of  accounting  systems  to  determine  their  compliance  with  the  13  key 
accounting  requirements.  The  Regulation  further  states  that  a  material 
noncompliance  with  a  key  accounting  requirement  requires  corrective  action 
within  a  reasonable  period.  The  13  key  accounting  requirements  and  a  brief 
description  of  each  requirement  are  in  Appendix  E. 

Annual  Reviews.  The  DFAS  is  responsible  for  establishing  procedures 
for  conducting  annual  reviews  of  accounting  system  controls.  The  DFAS 
assigned  the  responsibility  for  performing  annual  reviews  to  DFAS  system 
managers.  The  Regulation  states  that  users  of  DoD  accounting  systems  shall 
work  with  DFAS  system  managers  in  conducting  the  annual  reviews  and  in 
producing  the  documented  results  of  management's  assessment. 
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In  FYs  1993  and  1994,  DFAS  prepared  and  issued  a  System  Manager/User 
Review  Guide  (the  Review  Guide)  to  assist  managers  and  users  of  DoD 
accounting  systems  in  conducting  annual  reviews  of  accounting  system  controls. 
The  Review  Guide  contains  questions  for  system  managers  to  answer  in 
determining  compliance  of  their  accounting  systems  with  applicable  key 
accounting  requirements. 

Cyclical  Reviews.  On  a  cyclical  basis,  DFAS  review  teams  conduct  an 
independent,  comprehensive  evaluation  (Consolidated  System  Evaluation)  of 
accounting  systems  controls.  The  Regulation  states  that  DFAS  will  perform  a 
cyclical  review  of  each  accounting  system  once  every  3  years.  We  did  not 
evaluate  the  process  for  cyclical  reviews  of  accounting  systems.  In  1994  DFAS 
performed  a  Consolidated  System  Evaluation  of  one  of  the  three  accounting 
systems  in  our  audit  scope.  The  evaluation  concluded  that  the  system  did  not 
comply  with  key  accounting  requirements.  Appendix  B  discusses  the  results  of 
that  evaluation. 


Audit  Objectives 


The  announced  audit  objective  was  to  evaluate  the  adequacy  of  the 
DISA  WESTHEM  management  control  structure  for  FY  1994.  As  part  of  the 
objective,  we  also  evaluated  the  effectiveness  of  the  DFAS  annual  reviews  of 
accounting  systems  that  processed  and  prepared  DISA  WESTHEM  FY  1994 
financial  statements.  Appendix  A  discusses  the  audit  scope  and  methodology. 
Appendix  B  provides  a  summary  of  prior  coverage  related  to  the  audit 
objectives.  Appendix  C  discusses  actions  DISA  WESTHEM  implemented  or 
planned  during  the  audit  to  correct  weaknesses  in  the  management  control 
program  and  the  status  of  an  uncorrected  material  management  control 
weakness. 
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Annual  Reviews  of  Accounting  System 
Controls 

The  DFAS  and  DISA  WESTHEM  did  not  adequately  review  accounting 
system  controls  as  required  by  DoD  Directive  5010.38  and  DoD 
Financial  Management  Regulation  7000. 14-R. 

Inadequate  review  of  accounting  system  controls  occurred  because 
DFAS  and  DISA  WESTHEM  did  not: 

o  coordinate  the  performance  of  annual  reviews  to  include 
specifying  responsibilities  of  the  DFAS  system  manager  and  DISA 
WESTHEM  system  user; 

o  train  DFAS  system  managers  or  system  users  in  performing 
annual  reviews; 

o  document  accounting  system  controls  and  control  reviews; 

and, 


o  consider  prior  audits  and  other  evaluations  of  system 
performance. 

As  a  result,  DFAS  and  DISA  WESTHEM  annual  reviews  of  accounting 
systems,  a  principal  tool  for  implementing  a  management  control 
program,  cannot  be  relied  on  to  verify  the  adequacy  of  accounting 
system  controls,  which  constitutes  a  material  management  control 
weakness.  Verification  of  accounting  system  controls  helps  ensure  the 
accuracy,  completeness,  and  reliability  of  DISA  WESTHEM  financial 
statements. 


Conducting  Annual  Accounting  System  Reviews 


Coordinating  the  Performance  of  Annual  Reviews.  A  primary  reason  for 
annual  reviews  is  to  verify  that  accounting  controls  are  adequate  to  ensure  the 
accuracy,  completeness,  and  reliability  of  die  accounting  system  users'  financial 
statements.  The  DFAS  accounting  system  managers  and  DISA  WESTHEM 
system  users  are  responsible  for  establishing  specific  accounting  system  controls 
because  system  managers  and  users  are  involved  in  the  various  functional 
operations  that  comprise  an  accounting  system  as  defined  by  the  Regulation. 
System  users  authorize  accounting  transactions  and  participate,  directly  or 
indirectly,  in  recording,  classifying,  and  analyzing  the  transactions.  The  DFAS 
system  managers,  on  the  other  hand,  are  responsible  for  ensuring  the  accuracy 
of  financial  information  from  the  point  of  data  entry  into  the  accounting  system 
through  reporting  of  the  financial  information.  The  Regulation  requires  that 
users  work  with  system  managers  in  conducting  annual  reviews  of  accounting 
system  controls  and  in  producing  the  documented  results  of  the  assessments  of 
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system  compliance  with  key  accounting  requirements.  The  lack  of  user 
participation  in  annual  reviews  results  in  less  assurance  that  accounting  controls 
are  adequate  to  detect  or  prevent  the  input  of  unauthorized  or  inaccurate 
financial  information  into  the  accounting  systems. 

Reviews  of  Accounting  Systems  Supporting  DISA  WESTHEM.  We 
evaluated  the  FYs  1993  and  1994  annual  reviews  of  accounting  system  controls 
for  three  accounting  systems  owned  and  operated  by  the  DFAS:  the  Defense 
Business  Management  System,  the  Industrial  Fund  Accounting  System,  and  the 
Standard  Finance  System.  Appendix  D  provides  details  on  how  the  systems 
operate  and  on  the  accounting  functions  they  perform.  The  three  DFAS  systems 
processed  71  percent  ($360  million)  of  the  $508  million  in  FY  1994  revenue  for 
DISA  WESTHEM  (see  Appendix  A).  Also,  the  Under  Secretary  of  Defense 
(Comptroller)  selected  the  Industrial  Fund  Accounting  System  as  the  interim 
financial  system1  for  the  Defense  Business  Operations  Fund-Information 
Processing  Business  Area.  The  three  systems  were  used  to  prepare  the  FY  1994 
financial  statements  for  DISA  WESTHEM.  The  FYs  1993  and  1994  annual 
reviews  of  accounting  system  controls  for  the  three  accounting  systems  were 
flawed  and,  therefore,  could  not  be  relied  on  to  provide  reasonable  assurance  on 
the  accuracy  and  completeness  of  financial  statements  produced  by  the  systems. 

Defense  Business  Management  System.  For  the  FYs  1993  and  1994 
annual  reviews,  the  DFAS  system  manager  for  the  Defense  Business 
Management  System  performed  the  annual  reviews  without  coordinating  with 
system  users  or  documenting  Review  Guide  responses.  In  addition,  the  system 
manager  certified  the  system  as  compliant  with  requirements  prescribed  by  the 
General  Accounting  Office  and  the  Office  of  Management  and  Budget. 
However,  a  Consolidated  System  Evaluation  report,  "Evaluation  of  the 
Appropriated  Accounting  Sub-System  of  the  Defense  Business  Management 
System  at  Defense  Finance  and  Accounting  Service-Columbus  Center," 
April  15,  1994,  concluded  that  the  system  did  not  conform  to  the  principles, 
standards,  and  related  requirements  of  the  General  Accounting  Office; 
guidelines  of  the  Office  of  Management  and  Budget;  and  requirements  of  DoD. 
The  team  that  performed  the  Consolidated  System  Evaluation  cited 
57  conditions  requiring  corrective  actions  and  made  specific  recommendations 
to  correct  those  conditions.  The  DFAS  system  manager  should  have 
coordinated  the  FY  1994  annual  review  with  the  team  that  performed  the 
Consolidated  System  Evaluation.  Coordination  would  have  permitted  the 
manager  to  determine  the  specific  accounting  system  control  weaknesses 
associated  with  the  57  conditions. 

Industrial  Fund  Accounting  System.  The  DFAS  system  manager  for 
the  Industrial  Fund  Accounting  System  did  not  coordinate  the  annual  reviews 
with  system  users  or  document  Review  Guide  responses.  In  FYs  1993  and 
1994,  the  DFAS  system  manager  affirmatively  answered  system  user  questions 
in  the  Review  Guide  without  coordinating  with  the  system  user.  The  DFAS 
system  manager's  answers  were  based  on  his  knowledge  of  accounting 


1The  accounting  system  that  will  be  used  until  a  decision  is  reached  to  develop  a 
new  system  or  to  continue  with  the  current  system. 
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principles,  accounting  procedures,  and  accounting  system  capabilities. 
However,  the  documented  responses  may  have  been  significantly  different  if  the 
DFAS  system  manager  had  input  on  the  user's  practices  and  supporting 
documentation. 

Standard  Finance  System.  The  DFAS  system  manager  delegated 
completion  of  the  FY  1994  review  to  a  person  who  had  no  knowledge  of  or 
experience  in  management  controls,  did  not  understand  many  of  the  Review 
Guide  questions,  and  did  not  document  Review  Guide  answers.  The  reviewer 
answered  many  questions  in  the  FYs  1993  and  1994  Review  Guides  as  "not 
applicable"  with  an  explanation  that  user  input  needed  to  answer  the  question 
was  not  obtained.  Additionally,  the  FY  1994  annual  review  did  not  consider 
the  results  of  Army  Audit  Agency  Audit  Report  No.  SR  94-485,  "Audit  of  the 
Army's  FY  1993  Financial  Statements,"  August  30,  1994  (see  Appendix  B). 
The  DFAS  headquarters  personnel  advised  the  cognizant  DFAS  center  director 
that  previous  audit  report  results  should  be  considered  in  the  next  annual 
review. 


Participation  of  System  Manager  and  System  User  in 
Accounting  System  Reviews 

Review  Guide  Questions  Requiring  User  Input.  Based  on  our  analysis  of  the 
FY  1994  Review  Guide  and  on  subsequent  visits  to  DISA  WESTHEM  field 
offices,  we  identified  55  of  208  Review  Guide  questions  that  required  user  input 
because  the  questions  related  to  functional  operations  of  DISA  WESTHEM. 
We  analyzed  the  55  questions  to  determine  the  specific  DISA  WESTHEM 
accounting  function  covered  by  each  question.  Appendix  F,  Table  F-l, 
summarizes  the  number  of  questions  by  accounting  function  and  includes  a 
representative  question  for  each  function.  Table  F-2  shows  each  Review  Guide 
question  by  user  function  as  determined  by  our  analysis. 

Coordinating  User  Participation.  The  DFAS  system  managers  did  not  inform 
system  users  at  DISA  WESTHEM  organizations  that  annual  reviews  would  be 
performed.  Further,  DFAS  system  managers  were  not  trained  that  user  input 
was  necessary  for  a  reliable,  accurate,  and  complete  review. 

Completing  the  Review  Guide.  The  Review  Guides  completed  for  the 
Defense  Business  Management  System  and  the  Industrial  Fund  Accounting 
System  were  unreliable  because  in  answering  questions  needing  user  input, 
DFAS  system  managers  did  not  coordinate  with  users.  In  addition,  the  DFAS 
system  manager  for  the  Standard  Finance  System  did  not  provide  answers  to 
questions  that  required  user  input. 

Detecting  the  Need  for  User  Input.  A  DFAS  oversight  team,  which 
performed  reviews  of  selected  FY  1994  Review  Guides  in  October  1994, 
detected  the  lack  of  user  input  for  the  FY  1994  annual  review  of  the  Standard 
Finance  System.  The  DFAS  system  manager  had  noted  on  the  FY  1994  Review 
Guide  that  certain  questions  could  not  be  answered  because  user  input  had  not 


7 


Annual  Reviews  of  Accounting  System  Controls 


been  obtained.  The  oversight  team  advised  the  appropriate  DFAS  center  of  the 
need  for  user  input  in  conducting  annual  reviews.  The  oversight  team 
recommended  that  the  DFAS  system  manager  obtain  user  input  in  performing 
the  FY  1995  annual  review.  As  of  February  8,  1995,  the  DFAS  oversight  team 
had  not  completed  reviews  of  the  FY  1994  Review  Guides  for  the  Defense 
Business  Management  System  or  for  the  Industrial  Fund  Accounting  System. 


Training  System  Managers  and  System  Users 


DoD  Training  Requirements  Related  to  Management  Control 
Responsibilities.  The  Directive  states  that  DoD  managers  shall  be  provided 
training  in  their  management  control  responsibilities.  However,  DFAS  system 
managers  and  DISA  WESTHEM  users  were  not  trained  to  perform  reliable 
annual  reviews  of  accounting  systems  or  to  complete  the  Review  Guide  to 
accurately  reflect  the  results  of  the  annual  review. 

System  Manager  Training.  The  DFAS  did  not  establish  a  training 
program  to  ensure  system  managers  could  effectively  conduct  annual  reviews. 
System  managers: 

o  had  little  or  no  previous  experience  performing  and 
documenting  accounting  system  reviews; 

o  did  not  understand  the  meaning  or  intent  of  certain  Review 
Guide  questions; 

o  were  not  certain  as  to  which  FYs  1993  and  1994  Review 
Guide  questions  required  supporting  documentation  and,  therefore,  did  not 
provide  supporting  documentation  for  those  questions;  and 

o  answered  questions  based  on  their  knowledge  of  accounting 
system  requirements  rather  than  on  accounting  system  capabilities. 

System  User  Training.  The  DISA  WESTHEM  had  not  established  a 
training  program  to  ensure  system  users  could  effectively  participate  in  annual 
system  reviews.  Training  in  completing  the  Review  Guide  was  needed  at  three 
Defense  megacenters  we  visited.  Megacenter  officials  stated  that  DFAS  did  not 
provide  annual  review  training  to  their  system  users  and  that  the  users  were 
unfamiliar  with  the  Review  Guide.  We  believe  that  training  is  needed  because 
personnel  at  the  megacenters,  as  system  users,  are  responsible  for  answering 
certain  Review  Guide  questions  (see  Appendix  F)  concerning  specific 
accounting  transactions  and  related  controls  evaluated  during  the  annual  review. 
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DFAS  Initiatives.  The  DISA  WESTHEM  personnel  at  the  megacenters 
told  us  that  DFAS  had  trained  them  in  how  to  use  the  Industrial  Fund 
Accounting  System.  The  training,  which  is  an  ongoing  program,  covered  a 
users  manual  and  how  to  input  accounting  transactions.  We  believe  that  the 
DFAS  training  program  could  be  expanded  to  include  system  user  participation 
in  annual  reviews. 


Documenting  Annual  Reviews  of  Accounting  System  Controls 


DoD  Requirements  for  Supporting  Documentation  for  Annual  Reviews. 
Although  the  Directive  and  the  Regulation  require  supporting  documentation  for 
annual  reviews,  the  annual  reviews  for  FYs  1993  and  1994  did  not  have 
supporting  documentation  on  the  controls  reviewed.  The  FY  1993  Review 
Guide  stated  that  documentation  was  mandatory  to  support  questions.  System 
managers  indicated  on  the  FY  1993  Review  Guide  that  supporting 
documentation  was  available;  however,  they  did  not  provide  the  supporting 
documentation  for  our  review.  The  FY  1993  Review  Guide  also  specified  that 
acceptable  testing  procedures,  criteria,  and  standards  be  used  in  reviewing 
accounting  system  controls.  The  FY  1994  Review  Guide  did  not  specify  that 
supporting  documentation  was  required  and  did  not  specify  using  acceptable 
testing  procedures,  criteria,  or  standards  in  reviewing  accounting  system 
controls. 

DoD  Regulatory  Guidance  Related  to  Management  Controls.  The  Directive 
requires  that  management  controls  be  documented  to  ensure  that  specific  control 
objectives  are  met.  The  Directive  distinguishes  between  system  documentation 
and  review  documentation.  System  documentation  is  written  material  on 
organizational  structure,  operating  procedures,  and  responsibilities  and 
authorities  for  accomplishing  programs  and  activities.  Review  documentation  is 
written  material  showing  die  type  and  scope  of  accounting  system  control 
reviews,  key  findings,  and  recommended  corrective  actions.  The  Directive 
states  that  all  reviews  of  management  controls  should  produce  written  materials 
documenting  what  was  done  and  what  was  found.  Annual  accounting  system 
reviews  require  both  system  documentation  and  review  documentation  to 
support  answers  to  specific  Review  Guide  questions. 

Documentation  was  required  to  support  affirmative  responses  to  112  questions 
on  the  FY  1994  Review  Guide.  None  of  the  affirmative  answers  were 
supported  by  documentation.  Of  the  112  questions,  88  required  system 
documentation  and  24  required  review  documentation  to  include  documentation 
on  tests  of  accounting  system  controls.  Appendix  G,  Table  G-l  summarizes  the 
88  Review  Guide  questions  requiring  system  documentation,  shows  the 
categories  of  system  controls,  and  provides  representative  questions  for  each 
type  of  system  control.  Table  G-2  lists,  by  key  accounting  requirement,  each 
Review  Guide  question  requiring  system  documentation.  Appendix  H, 
Table  H-l  summarizes  the  24  Review  Guide  questions  requiring  review 
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documentation,  by  type  of  review  control,  and  provides  representative  questions 
for  each  type  of  review  control.  Table  H-2  lists,  by  key  accounting 
requirement,  each  Review  Guide  question  requiring  review  documentation. 

Air  Force  Audit  Agency  Identified  Need  for  Documenting  Annual  Reviews. 
Air  Force  Audit  Agency  Report  No.  93066024,  October  3,  1994,  emphasized 
the  need  for  documentation  to  support  accounting  system  reviews.  The  Air 
Force  Audit  Agency  determined  that  a  DFAS  Defense  Accounting  Office  did 
not  maintain  documentation  to  support  the  determination  that  an  accounting 
system  complied  with  key  accounting  requirements.  The  Air  Force  Audit 
Agency  concluded  that  the  Defense  Accounting  Office  personnel  who  performed 
the  review  did  not  fully  understand  the  review  requirements  or  documentation 
needed  to  support  their  assessment,  and,  as  a  result,  the  Air  Force  was 
susceptible  to  waste,  loss,  or  misappropriation.  Appendix  B  provides  additional 
details  on  the  results  of  the  Air  Force  audit. 

Benefits  of  Documentation  in  Support  of  Annual  Reviews.  Documentation 
not  only  lends  credibility  to  annual  reviews,  but  also  is  needed  so  the  review 
results  can  be  relied  on  to  expedite  other  reviews  and  audits.  For  example  as  a 
preparatory  step  in  performing  cyclical  reviews  of  accounting  systems,  DFAS 
review  teams  requested  that  system  managers  provide  documentation  on 
completed  transaction  tests  and  on  system  controls.  That  documentation  can 
also  be  relied  on  for  financial  statement  audits.  For  example,  the  planning 
process  for  financial  statement  opinion  audits  and  audits  of  accounting  system 
controls  could  be  expedited  by  analyzing  documentation  associated  with  annual 
reviews.  Additional  time  needed  for  system  managers  and  users  to  gather 
documentation  for  annual  reviews  should  be  minimal  because  Review  Guide 
responses  indicated  that  documentation  should  be  readily  available.  Most 
important,  annual  accounting  system  reviews  will  be  significantly  strengthened 
by  the  documentation  of  previously  reported  accounting  system  weaknesses  and 
management  assurances  that  those  weaknesses  have  been  or  will  be  corrected. 


Considering  Audits  and  Other  Evaluations 


In  planning  annual  reviews,  DFAS  system  managers  did  not  use  the  results  of 
other  system  audits,  studies,  and  evaluations  to  identify  potentially  inadequate, 
weak,  or  vulnerable  management  controls.  The  FYs  1993  and  1994  Review 
Guides  required  system  managers  to  consider  other  indicators  of  system 
performance,  such  as  audit  reports,  system  evaluations,  and  system  change 
requests.  The  Review  Guides  specified  that  such  performance  indicators  were 
to  be  gathered  and  reviewed  and  that  the  results  were  to  be  used  in  evaluating 
the  accounting  system.  Further,  the  Review  Guides  required  system  managers 
to  consider  quality  assurance  reviews,  audit  findings  and  reports,  past  system 
evaluations,  and  software  acceptance  test  results  to  determine  the  need  to  test 
controls  over  key  accounting  requirements.  However,  as  described  on  pages  6 
and  7  of  the  report,  the  system  managers  for  the  Defense  Business  Management 
System  and  the  Standard  Finance  System  did  not  consider  the  results  of  specific 
audits  and  evaluations.  Appendix  B  describes  the  specific  accounting  system 
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weaknesses  detected  during  those  and  other  audits  and  evaluations  of  the  three 
accounting  systems  in  the  audit  scope.  Because  system  managers  did  not 
consider  fie  results  of  audits  and  other  evaluations,  annual  reviews  did  not  focus 
on  documented  accounting  system  weaknesses.  As  a  result,  annual  reviews 
were  not  planned  or  performed  to  determine  whether  adequate  corrective  actions 
were  planned  or  taken  to  correct  accounting  system  control  weaknesses  cited  in 
the  reports. 


Conclusion 


The  FY  1994  management  control  program  for  the  Defense  Business 
Management  System,  the  Industrial  Fund  Accounting  System,  and  the  Standard 
Finance  System,  cannot  be  relied  on  to  verify  the  accuracy,  completeness,  and 
reliability  of  DISA  WESTHEM  FY  1994  financial  statements.  Accounting 
system  controls  designed  to  prevent  or  detect  material  errors,  omissions,  and 
misstatements  in  DISA  WESTHEM  FY  1994  financial  statements  were  not 
adequately  reviewed  to  determine  whether  the  controls  were  in  place  and 
working.  Therefore,  DISA  WESTHEM  financial  statements  may  contain 
material  errors,  omissions,  or  misstatements  and  cannot  be  relied  on  in  making 
informed  business  decisions.  A  copy  of  this  report  will  be  provided  to  the 
senior  official  responsible  for  management  controls  within  the  Defense 
Information  Systems  Agency  and  the  Defense  Finance  and  Accounting  Service. 

The  Review  Guide  is  a  well-designed  tool  for  performing  annual  reviews  of 
accounting  systems.  The  Review  Guide  questions  are  specifically  designed  to 
assist  management  in  determining  whether  adequate  accounting  controls  are  in 
place  and  working  to  ensure  that  an  accounting  system  is  producing  complete 
and  reliable  financial  reports.  If  DFAS  system  managers  and  DISA 
WESTHEM  system  users  are  trained  in  and  coordinate  in  properly  completing 
and  documenting  the  Review  Guide,  it  will  provide  credible  and  useful  data  on 
whether  an  accounting  system  meets  generally  accepted  Government  accounting 
requirements. 


Recommendations,  Management  Comments,  and  Audit 
Responses 


Revised  Recommendation.  As  requested  in  the  DFAS  comments  on  the  draft 
report,  we  added  the  reference  to  DoD  Regulation  7000. 14-R  in 
Recommendation  2. a. 

1.  We  recommend  that  the  Director,  Defense  Finance  and  Accounting 
Service  and  the  Director,  Defense  Information  Systems  Agency,  Western 
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Hemisphere  establish  a  Memorandum  of  Agreement  to  provide  the  specific 
responsibilities  for  system  managers  and  system  users  in  performing  the 
FY  1996  and  subsequent  annual  reviews. 

Management  Comments.  The  DFAS  nonconcurred,  stating  that  a 
Memorandum  of  Agreement  with  DISA  was  not  needed  because  existing 
guidance  in  the  Review  Guide  and  the  Regulation  require  user  participation  in 
annual  reviews.  However,  DFAS  stated  that  the  existing  guidance  would  be 
reinforced  to  specifically  require  inclusion  of  selected  system  users  in  each 
annual  accounting  system  review  of  migratory2  and  interim  migratory 
accounting  systems  and  would  be  considered  in  annual  accounting  system 
reviews  of  selected  legacy3  accounting  systems.  Also,  memorandums 
transmitting  annual  Review  Guides  to  DFAS  centers  would  require  user 
participation  in  annual  accounting  system  reviews. 

Audit  Response.  Although  DFAS  nonconcurred  with  the  recommendation,  the 
proposed  user  participation  in  annual  accounting  system  reviews  satisfies  the 
intent  of  the  recommendation. 

2.  We  recommend  that  the  Director,  Defense  Finance  and  Accounting 
Service: 

a.  Implement  the  requirements  of  DoD  Directive  5010.38,  "Internal 
Management  Control  Program,"  April  14,  1987,  and  DoD  7000. 14-R, 
"Financial  Management  Regulation,"  volume  I,  chapter  3,  May  1993,  by 
establishing  a  training  program  on  the  purpose,  objective,  scope,  and 
performance  of  annual  accounting  system  reviews  for  the  system  managers 
of  the  Standard  Finance  System,  the  Defense  Business  Management 
System,  and  the  Industrial  Fund  Accounting  System,  and  for  system  users 
at  the  Defense  Information  Systems  Agency,  Western  Hemisphere. 

Management  Comments.  The  DFAS  partially  concurred,  stating  that  training 
on  the  conduct  of  annual  reviews  is  provided  to  participants  at  an  annual  DFAS 
Federal  Managers'  Financial  Integrity  Act  section  4  conference. 

The  DFAS  stated  that  some  DoD  Components  do  not  participate  in  the  annual 
conference  and  that  some  DoD  Components  do  not  have  assigned  section  4 
coordinators.  For  DoD  Components  that  do  not  participate  in  the  annual 
conference,  appropriate  DFAS  centers  will  provide  guidance  to  assist  system 
managers  and  selected  system  users  on  the  conduct  of  annual  system  reviews. 
The  DFAS  also  stated  that  system  managers  will  be  provided  points  of  contact 
from  appropriate  DFAS  centers  and  DFAS  headquarters  to  answer  specific 
questions  concerning  the  conduct  of  annual  accounting  system  reviews. 


2An  existing  or  planned  and  approved  automated  information  system  that  has 
been  designated  to  support  a  functional  process  on  a  DoD-wide  basis. 

3An  existing  accounting  system  that  has  not  been  selected  as  a  migratory  or 
interim  migratory  automated  information  system. 
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b.  Implement  the  requirements  of  DoD  Directive  5010.38,  "Internal 
Management  Control  Program,"  April  17,  1987,  by  specifying  in  the 
FY  1996  and  subsequent  System  Manager/User  Review  Guides  that  system 
managers  must  retain  system  and  review  documentation  supporting 
affirmative  responses  to  System  Manager/User  Review  Guide  questions. 
Documentation  must  evidence  that: 

o  accounting  system  controls  are  in  place,  and 

o  periodic  control  testing  was  performed  to  demonstrate  that 
the  controls  were  working  as  designed. 

Management  comment.  The  DFAS  concurred,  stating  that  the  FY  1996 
Review  Guide  will  require  systems  managers  to  retain  documentation  supporting 
answers  provided  in  the  annual  system  review. 

c.  Direct  system  managers  to  consider  the  results  of  audits  and 
other  related  evaluations  of  the  accounting  system  controls  in  completing 
the  FY  1996  and  subsequent  System  Manager/User  Review  Guides. 

Management  Comments.  The  DFAS  concurred,  stating  that  the  annual 
System  Manager/User  Review  Guide  will  require  system  managers  to  examine 
prior  reviews,  evaluations,  or  audits  and  to  consider  any  applicable  audit  finding 
or  recommendation  in  the  system  review  process.  Further,  DFAS  will  forward 
copies  of  audit  findings  on  potential  Federal  Managers'  Financial  Integrity  Act 
weaknesses  to  appropriate  section  4  coordinators  for  consideration  in  their 
current  year  Federal  Managers'  Financial  Integrity  Act  program. 

3.  We  recommend  that  the  Director,  Defense  Information  Systems  Agency, 
Western  Hemisphere,  issue  a  policy  memorandum  to  the  Directors,  Defense 
megacenters,  directing  them  to  schedule  training  on  the  conduct  of  FY  1996 
annual  accounting  system  reviews  for  employees  that  perform  accounting 
functions  and  functions  related  to  the  entry  of  accounting  data  into  an 
automated  accounting  system  for  the  Defense  Finance  and  Accounting 
Service. 

Management  Comments.  The  DISA  did  not  comment  on  a  draft  of  this 
report.  Therefore,  we  request  that  DISA  provide  comments  in  its  response  to 
the  final  report. 
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Part  II  -  Additional  Information 


Appendix  A.  Scope  and  Methodology 

Audit  Scope 


We  judgmentally  selected  8  of  16  assessable  units  at  DISA  WESTHEM  to 
evaluate  the  effectiveness  of  the  DISA  WESTHEM  FY  1994  management 
control  program.  In  addition,  we  evaluated  the  annual  reviews  of  three  DFAS 
accounting  systems  used  to  prepare  the  DISA  WESTHEM  FY  1994  financial 
statements.  The  three  accounting  systems  were  the  Industrial  Fund  Accounting 
System,  the  Defense  Business  Management  System,  and  the  Standard  Finance 
System.  Those  three  systems  processed  financial  information  for  46  of  the 
62  DISA  WESTHEM  reporting  units.  The  46  units  reported  FY  1994  revenues 
of  $360  million  (71  percent  of  FY  1994  revenues  totaling  $508  million).  We 
selected  revenues  as  a  basis  for  the  measurement  of  accounting^  system  support, 
because  DISA  WESTHEM  Plant,  Property,  and  Equipment  accounts  were 
processed  through  site-unique  accounting  systems  and  were  not  reflected  in 
DFAS  accounting  systems.  We  did  not  evaluate  the  process  for  cyclical  reviews 
of  accounting  systems. 


Audit  Methodology 


For  each  of  the  eight  assessable  units,  we: 

o  determined  the  extent  to  which  management  control  objectives  and 
techniques  were  documented  by  unit  managers; 

o  interviewed  the  assessable  unit  managers  to  determine  the 
methodology  they  used  in  performing  risk  assessments  of  their  units; 

o  evaluated  the  methodology,  scope,  and  results  of  management  control 
reviews  performed  by  unit  managers; 

o  determined  whether  unit  managers  received  training  in  performing 
annual  reviews  of  management  controls;  and, 

o  obtained  and  reviewed  the  managers'  performance  standards  for 
inclusion  of  management  control  responsibilities  as  a  critical  element. 

We  also  reviewed  the  reasonableness  of  the  assessable  unit  structure  at  DISA 
WESTHEM  and  obtained  and  evaluated  the  DISA  WESTHEM  FY  1994  Annual 


*Plant,  Property,  and  Equipment  is  the  selected  account  that  will  be  discussed  in 
Report  No.  95-209,  "Defense  Business  Operations  Fund-Defense  Information 
Services  Organization  Financial  Statements  for  FY  1994,"  May  31,  1995. 
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Assurance  Statement  to  determine  whether  it  clearly  represented  the  work 
performed  by  assessable  unit  managers.  Finally,  we  evaluated  DISA  and  DISA 
WESTHEM  oversight  of  the  management  control  program. 

For  each  of  the  three  DFAS  accounting  systems,  we: 

o  evaluated  the  FYs  1993  and  1994  accounting  system  review  guidance 
and  oversight  DFAS  provided  to  the  system  managers; 

o  evaluated  the  FYs  1993  and  1994  annual  reviews  performed  by 
system  managers,  and  interviewed  system  managers  to  determine  the 
methodology  they  used  in  completing  the  reviews; 

o  reviewed  all  available  documentation  supporting  the  accounting 
system  reviews; 

o  determined  the  extent  to  which  a  system  manager  relied  on  the  input 
from  DISA  WESTHEM  or  other  DFAS  components  in  completing  the  reviews; 
and, 


o  analyzed  other  accounting  system  reviews  performed  by  DFAS. 

We  also  interviewed  officials  at  three  DISA  WESTHEM  Defense  megacenters 
to  determine  the  extent  to  which  personnel  at  the  megacenters  performed  the 
accounting  functions  covered  by  die  annual  reviews  and  the  extent  to  which 
those  personnel  participated  in  the  FY  1994  annual  reviews. 

We  reviewed  management  control  and  accounting  system  review  documentation 
dated  from  October  1992  through  November  1994.  We  did  not  use  computer- 
processed  data  or  statistical  sampling  procedures  to  evaluate  the  adequacy  of  the 
DISA  WESTHEM  management  control  program  or  the  DFAS  accounting 
system  reviews. 

Audit  Period,  Standards  and  Locations.  We  performed  this  financial  related 
audit  from  December  1994  through  February  1995  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States  as 
implemented  by  the  Inspector  General,  DoD.  Accordingly,  we  included  such 
tests  of  management  controls  considered  necessary.  Appendix  J  lists  the 
organizations  visited  or  contacted. 
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Appendix  B.  Summary  of  Prior  Audits  and 
Other  Reviews 


During  the  last  5  years,  the  General  Accounting  Office  and  the  Army  Audit 
Agency  issued  audit  reports  discussing  the  Standard  Finance  System,  the  Naval 
Audit  Service  issued  one  report  discussing  the  Industrial  Fund  Accounting 
System,  and  the  Air  Force  Audit  Agency  issued  one  report  discussing  the  annual 
accounting  system  review  process.  Also,  DFAS  issued  a  Consolidated  System 
Evaluation  on  a  major  subsystem  of  the  Defense  Business  Management  System. 

General  Accounting  Office  Report  No.  GAO/AIMD-93-1  (OSD  Case 
No.  9276-E),  "Financial  Audit:  Examination  of  the  Army's  Financial 
Statements  for  Fiscal  Years  1992  and  1991,"  June  30,  1993.  The  report 
states  that  inadequacies  in  the  Army's  accounting  system  and  the  system's 
failure  to  comply  with  DoD  and  Army  financial  policies  prevented  the  General 
Accounting  Office  from  expressing  an  opinion  on  the  financial  statements. 
Further,  several  weaknesses  discussed  in  the  report  were  repeat  findings  from 
the  audit  of  the  Army's  FY  1991  financial  statements.  The  report  also  states 
that  after  a  $196  billion  correction  for  computer  errors,  an  additional  $7  billion 
adjustment,  for  which  no  supporting  documentation  existed,  was  necessary  to 
reconcile  general  ledger  balances  with  budgetary  data  that  DFAS  considered  to 
be  accurate.  Although  the  report  does  not  specifically  reference  the  Standard 
Finance  System,  that  system  and  a  DFAS  processing  center  provide  a  significant 
portion  of  the  accounting  services  for  the  Army. 

Army  Audit  Agency  Report  No.  SR  94-485,  "Audit  of  the  Army's  FY  1993 
Financial  Statements,"  August  30, 1994.  The  report  discusses  FY  1993  Army 
financial  transactions  at  the  DFAS-Indianapolis  Center  and  six  accounting 
offices.  The  audit  scope  included  an  evaluation  of  financial  transactions 
supporting  financial  data  processed  by  the  Standard  Finance  System,  one  of  five 
primary  accounting  systems.  The  Army  Audit  Agency  determined  that  the 
accounting  systems  and  processes  did  not  produce  auditable  financial  statements 
required  by  the  Chief  Financial  Officers  Act. 

The  Army  Audit  Agency  found  accounting  system  weaknesses  concerning: 

o  lack  or  inadequacy  of  subsidiary  ledgers; 

o  failure  to  properly  post  financial  transactions  to  the  general  ledger; 

o  review,  identification,  and  correction  of  inappropriate  or  incorrect 
general  ledger  balances; 

o  accounting  personnel  lacking  knowledge  of  how  to  use  the  general 
ledger,  evaluate  the  relationship  between  accounts,  research  and  correct  errors, 
and  maintain  adequate  filing  systems;  and 

o  inadequate  audit  trails  for  collection  and  disbursement  vouchers. 
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The  Army  Audit  Agency  disclaimed  an  opinion  on  the  Army's  cash  flow 
statement  and  made  specific  recommendations  to  correct  the  conditions.  The 
Army  generally  concurred  with  the  recommendations  and  stated  that  corrective 
actions  would  be  implemented.  The  DFAS  did  not  agree  with  the  Army 
auditors'  recommendation  to  establish  subsidiary  ledgers  for  general  ledger 
accounts  in  the  Standard  Finance  System  and  another  Army  accounting  system, 
because  the  DFAS  believed  that  adequate  subsidiary  ledgers  already  existed. 
The  Army  Audit  Agency  stated  that  the  subsidiary  ledgers  referenced  in  the 
DFAS  comments  do  not  retain  transaction-level  detail.  Therefore,  the  Army 
auditors  will  not  be  able  to  test  general  ledger  balances  and  opine  on  future 
Army  financial  statements  until  the  Army  is  able  to  provide  an  automated  file  of 
detailed  transactions. 

Naval  Audit  Service  Report  No.  036-S-92,  "Followup  Audit  of  Automated 
Cost  Accounting  System  for  Naval  Regional  Data  Automation  Centers  and 
Naval  Data  Automation  Facilities,"  March  18,  1992.  The  report  discussed 
Navy  data  processing  sites  using  the  Navy  Industrial  Fund  Accounting  System. 
The  Naval  Audit  Service  determined  that  management's  actions  were  generally 
effective  in  eliminating  previous  weaknesses  in  accounting  system  controls. 
However,  Navy  auditors  found  that  data  processing  sites  performed  customer 
work  that  exceeded  available  customer  funding  and  that  management  controls 
were  not  adequate  to  prevent  the  cause  and  elimination  of  customer  overruns. 
The  Naval  Audit  Service  also  found  errors  in  data  entry  and  source 
documentation.  Navy  auditors  recommended  specific  actions  to  correct  the 
conditions,  and  the  Navy  agreed  with  the  recommendations,  stating  that 
corrective  actions  were  or  would  be  implemented. 

Air  Force  Audit  Agency  Report  No.  93066024,  "Review  of  Application 
Controls  Within  the  Financial  Inventory  Accounting  and  Billing  System," 
October  3,  1994.  The  audit  was  part  of  a  series  of  audits  related  to  the  Chief 
Financial  Officers  Act  of  1990.  The  report  states  that  a  Defense  Accounting 
Office  inappropriately  reported  that  the  Financial  Inventory  Accounting  and 
Billing  System  was  in  compliance  with  accounting  and  management  control 
requirements  of  the  Federal  Managers'  Financial  Integrity  Act  because  the 
Defense  Accounting  Office  had  not  performed  system  and  transaction  testing 
needled  to  support  that  assessment.  Further,  as  part  of  the  review,  the  Air  Force 
Audit  Agency  determined  that  the  Defense  Accounting  Office  did  not  maintain 
documentation  of  other  analyses  it  performed  to  support  the  conclusion  that  the 
Financial  Inventory  Accounting  and  Billing  System  complied  with  key 
accounting  requirements  prescribed  in  DoD  Regulation  7000. 14-R,  "Department 
of  Defense  Financial  Management  Regulation, "  May  1993. 

The  report  concludes  that  Defense  Accounting  Office  personnel  who  performed 
the  review  did  not  hilly  understand  the  review  requirements  or  documentation 
needed  to  support  their  assessment,  and,  as  a  result,  the  Air  Force  was 
susceptible  to  waste,  loss,  or  misappropriation  of  $41  billion  of  assets  processed 
by  the  Financial  Inventory  Accounting  and  Billing  System. 

The  Air  Force  recommended  that  DFAS  perform  required  system  and 
transaction  testing  and  maintain  test  results  and  other  documentation  to  support 
future  reviews  of  the  system.  The  DFAS  concurred  in  principle,  but  stated  that 
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DFAS  developed  the  Review  Guide  to  describe  the  specific  steps  system 
managers  should  follow  in  performing  annual  reviews.  The  DFAS  also  stated 
that  the  Review  Guide  does  not  require  system  managers  to  perform  system  and 
transaction  testing  and  that  the  Review  Guide  was  the  only  documentation 
required  by  DFAS  to  support  a  general  review.  The  DFAS  evaluation  teams 
performed  consolidated  system  evaluations,  which  are  detailed  reviews  of 
accounting  systems  that  include  system  and  transaction  testing. 

The  Air  Force  Audit  Agency  stated  that  the  FY  1994  Review  Guide  was 
significantly  weakened  when  DFAS  deleted  the  following  significant 
requirements  that  had  been  included  in  the  FY  1993  Review  Guide.  The 
FY  1993  Review  Guide  required  that  system  managers: 

o  certify  the  compliance  of  their  system  with  the  key  accounting 
requirements  in  DoD  Regulation  7000. 14-R; 

o  perform  system  and  transaction  testing  to  validate  compliance  of  the 
systems  with  key  accounting  requirements;  and 

o  retain  assessment  and  supporting  documentation  for  1  year  for 
possible  audit  review. 

The  Air  Force  auditors  stated  that  DFAS  should  reinstitute  the  requirements  in 
the  Review  Guide  to  make  it  an  effective  review  tool.  The  Air  Force  Audit 
Agency  referred  this  issue  to  the  Inspector  General,  DoD.  This  report  discusses 
the  need  for  effective  annual  reviews  of  accounting  system  controls  and  the  need 
for  the  FY  1996  and  subsequent  year  Review  Guides  to  specify  retaining  system 
and  review  documentation. 

Defense  Finance  and  Accounting  Service.  The  DFAS  issued  the  Consolidated 
System  Evaluation  report,  "Evaluation  of  the  Appropriated  Accounting  Sub- 
System  of  the  Defense  Business  Management  System  at  Defense  Finance  and 
Accounting  Service-Columbus  Center,"  April  15,  1994.  The  purpose  of  the 
evaluation  was  to  determine  whether  the  Defense  Business  Management  System 
was  operating  in  accordance  with  the  accounting  principles  promulgated  by  the 
General  Accounting  Office  as  implemented  by  the  Office  of  Management  and 
Budget  and  DoD.  The  scope  of  the  evaluation  included  a  review  of  selected 
transactions  performed  by  system  managers  and  users.  The  evaluation  stated 
that  the  Defense  Business  Management  System  did  not  conform  to  the 
principles,  standards,  and  related  requirements  of  the  General  Accounting 
Office  and  Office  of  Management  and  Budget  guidelines  and  DoD 
requirements.  The  evaluation  team  identified  57  conditions  and  made  specific 
recommendations  to  correct  the  conditions.  The  evaluation  team  found  the 
following  weaknesses: 

o  management  controls  were  not  in  place  to  prevent  duplicate  vendor 
payments, 

o  reconciliations  were  inconsistent  between  accounting  branches, 

o  work  areas  lacked  standard  operating  procedures, 
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o  additional  training  was  needed  by  both  system  managers  and  users, 

o  multiple  sources  performed  data  entry, 

o  large  backlogs  of  transactions  existed  in  some  areas,  and 

o  the  Defense  Business  Management  System  did  not  use  the  standard 
general  ledger. 

The  DFAS  Columbus  generally  concurred  with  recommended  actions  or 
recommended  acceptable  alternative  actions.  The  evaluation  team  is  tracking 
the  status  of  corrective  actions. 
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Appendix  C.  Other  Matters  of  Interest 


DISA  WESTHEM  Management  Control  Program.  In  addition  to  accounting 
system  control  weaknesses  discussed  in  the  finding,  we  detected  other 
weaknesses  in  DISA  WESTHEM  management  control  program.  The  DISA 
WESTHEM  FY  1994  management  control  program  did  not  fully  comply  with 
the  requirements  of  DISA  WESTHEM  Instruction  630-125-6,  "DCA  Internal 
Management  Control  Program,"  July  23,  1987.  Specifically,  DISA 
WESTHEM  did  not: 

o  properly  segment  its  assessable  unit  structure  because  its 
16  megacenters,  which  comprised  the  majority  of  its  mission  and  resources, 
were  categorized  as  only  one  of  16  assessable  units; 

o  establish  a  management  control  plan; 

o  perform  timely  risk  assessments; 

o  perform  management  control  reviews  for  7  of  8  units;  and 

o  include  management  control  program  duties  in  the  performance  plans 
of  assessable  unit  managers  as  a  critical  performance  element. 

During  the  audit,  DISA  WESTHEM  implemented  or  planned  actions  to  correct 
the  weaknesses  in  its  program.  The  DISA  WESTHEM  resegmented  its 
assessable  unit  structure  to  more  accurately  reflect  its  mission;  prepared  a  5-year 
management  control  plan  in  FY  1995,  requiring  in-depth  risk  assessments  and 
management  control  reviews  for  all  assessable  units;  and  issued  a  directive 
requiring  that  performance  plans  for  assessable  unit  managers  include 
management  control  duties  as  a  critical  performance  element.  These  actions,  if 
fully  implemented,  will  correct  the  weaknesses. 

Material  Weakness  in  Computer  System  Security.  The  DISA  WESTHEM 
referenced  an  uncorrected  material  internal  control  weakness  concerning 
computer  system  security  in  its  FY  1994  Annual  Statement  of  Assurance.  The 
weakness  was  detected  during  prior  Inspector  General,  DoD,  audits.  The 
following  DoD  audit  reports  identified  numerous  occurrences  of  the  material 
management  control  weakness  that  adversely  affected  computer  system  security 
at  DISA  WESTHEM  information  processing  centers: 

o  Audit  Report  No.  94-065,  "Controls  Over  Operating  System  and 
Security  Software  Supporting  the  Defense  Finance  and  Accounting  Service," 
March  24,  1994; 

o  Audit  Report  No.  94-060,  "General  Controls  for  Computer  Systems  at 
the  Information  Processing  Centers  of  the  Defense  Information  Services 
Organization,"  March  18,  1994; 
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o  Audit  Report  No.  93-133,  "Controls  Over  Operating  System  and 
Security  Software  Supporting  the  Defense  Finance  and  Accounting  Service," 
June  30,  1993;  and, 

o  Audit  Report  No.  93-002,  "Controls  Over  Operating  System  and 
Security  Software  Supporting  the  Defense  Finance  and  Accounting  Service," 
October  2,  1992. 

The  Director,  DISA  WESTHEM,  concurred  with  the  findings  and 
recommendations,  and  provided  responsive  corrective  actions. 

The  Inspector  General,  DoD,  performed  a  followup  audit  to  verify  that 
corrective  actions  on  previously  reported  computer  system  security  weaknesses 
were  implemented.  Inspector  General,  DoD,  audit  report  "Controls  Over 
Operating  System  and  Security  Software  and  Other  General  Controls  for 
Computer  Systems  Supporting  die  Defense  Finance  and  Accounting  Service," 
Report  No.  95-263,  June  29,  1995,  states  that  DISA  WESTHEM  made 
commendable  efforts  to  implement  prior  audit  recommendations  at  the  audited 
locations,  but  that  additional  corrective  actions  were  still  required.  Management 
concurred  with  the  report  recommendations  and  planned  actions,  which  will 
correct  the  conditions  noted  during  the  audit. 
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Industrial  Fund  Accounting  System.  The  Industrial  Fund  Accounting  System 
is  a  batch-oriented  Defense  Business  Operations  Fund  accounting  system  that  is 
custom-designed  to  support  fee-for-service  providers  of  Government 
information  technology  and  services.  The  Industrial  Fund  Accounting  System 
processed  only  about  $22.7  million  of  DISA  WESTHEM  FY  1994  total 
customer  revenues  of  $508  million.  However,  on  November  16,  1994,  the 
Defense  Business  Operations  Fund  Corporate  Board  selected  the  Industrial  Fund 
Accounting  System  as  the  interim  approved  system  for  the  information 
processing  business  area.  Therefore,  DISA  WESTHEM  plans  to  use  the 
Industrial  Fund  Accounting  System  to  process  all  accounting  transactions  by  the 
beginning  of  FY  1996.  The  Industrial  Fund  Accounting  System  consists  of 
three  subsystems:  accounting,  budgeting,  and  chargeback. 

Accounting  Subsystem.  The  accounting  subsystem  consists  of  eight 
transaction  driven  applications  and  an  on-line  data  entry  and  telecommunications 
network.  The  accounting  subsystem  is  designed  to  support  multiple  remote 
entities  and  has  the  capability  to  meet  corporate  financial  reporting 
requirements.  The  eight  applications  include  a  property  accounting  system  and 
a  general  ledger  system  that  provide  trial  balances  and  die  required  financial 
statements. 

Budget  Subsystem.  The  budget  subsystem  is  a  real-time,  on-line 
database  management  information  system  used  to  develop  Defense  Business 
Operating  Fund  billing  rates  using  the  fee-for-service  concept. 

Chargeback  Subsystem.  The  chargeback  subsystem  provides  billing 
and  utilization  data  for  human  and  other  resources  involved  in  the  production  of 
data  processing  services.  The  process  is  accomplished  through  a  combination  of 
capturing  data  from  automated  logs  (for  example,  central  processing  unit  time, 
input  and  output  time,  and  tape  mounts)  from  a  variety  of  computer  hardware, 
and  labor  and  nonlabor  costs  passed  from  the  accounting  subsystem  through  an 
automated  interface  to  the  customer. 

Defense  Business  Management  System.  The  Defense  Business  Management 
System  is  a  fully  automated  integrated  management  system  that  consists  of  four 
major  subsystems.  The  four  subsystems  are  the  Personnel  Subsystem,  the 
Payroll  Subsystem,  the  Resource  Administration  Subsystem,  and  the 
Appropriation  Accounting  Subsystem.  All  Defense  Business  Management 
System  subsystems,  except  the  Personnel  Subsystem,  perform  finance  and 
accounting  related  functions.  In  FY  1994,  the  Defense  Business  Management 
System  processed  about  $246  million  in  revenues  for  DISA  WESTHEM,  or 
about  48  percent  of  DISA  WESTHEM  FY  1994  revenues.  Major  Defense 
Business  Management  System  accounting  functions  include: 

o  general  ledger  accounting; 

o  budgetary  accounting  and  funds  control; 
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o  cost  accounting,  including  job  order  cost  accounting  and  unit  cost 
accounting  capability; 

o  accounting  for  receivables  and  payables; 

o  a  fully  integrated  civilian  payroll  system,  and  military  payroll 
accounting  functions;  and 

o  accounting  and  managerial  reporting. 

Standard  Finance  System.  The  Standard  Finance  System  is  a  fully  automated. 
Army-wide  standard  accounting  system  designed  to  provide  comprehensive 
accounting  support  at  Army  installations  and  effective  general  ledger  control 
over  all  assets.  In  FY  1994,  the  Standard  Finance  System  processed  about 
$91.2  million  in  revenues  for  DISA  WESTHEM,  or  about  18  percent  of  DISA 
WESTHEM  FY  1994  revenues.  The  Standard  Finance  System  was  developed 
by  the  Army  to  provide  full  disclosure  of  financial  information  of  Army 
activities,  general  ledger  control  and  accountability  of  funds  and  other  assets, 
and  data  required  to  support  budgetary  and  management  decisions. 
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The  DFAS  established  13  key  accounting  requirements,  which  are  included  in 
the  Regulation.  The  FY  1993  and  FY  1994  Review  Guides  contain  questions 
designed  to  assist  system  managers  and  users  in  determining  whether  accounting 
system  controls  are  in  place  and  working  for  the  13  key  accounting 
requirements.  Responses  to  questions  related  to  seven  key  accounting 
requirements  are  mandatory  and  must  be  completed  for  all  DoD  accounting 
systems.  The  Review  Guides  require  the  reviewer  to  determine  the  applicability 
of  the  other  six  key  accounting  requirements  to  the  specific  accounting  system 
under  review. 


Key  Accounting  Requirement  (KAR)  1,  General  Ledger 
Control,  and  Financial  Reporting 


The  system  must  have  general  ledger  control  and  maintain  a  general  ledger 
account  structure  for  assets,  liabilities,  equity,  expenses,  losses,  gains,  transfers 
in  and  out,  and  financing  sources.  The  system  must  list  both  control  and 
subsidiary  general  ledger  accounts  by  titles  and  numbers  with  a  definition  of 
each  account  and  be  based  on  double-entry  accounting.  Subsidiary  accounts 
shall  be  reconciled  to  the  control  accounts  at  least  monthly.  This  KAR  is 
applicable  to  all  systems. 


KAR  2,  Property  and  Inventory  Accounting 


The  system  must  account  in  quantitative  and  monetary  terms  for  the 
procurement,  receipt,  issue,  and  control  of  plant  property,  equipment, 
inventory,  and  material.  Property  records  should  contain  information  on 
equipment  description,  acquisition  date,  original  cost,  estimated  life,  location, 
and  depreciation.  Proper  accounting  controls  should  exist  for 
Government-owned  property  held  and  used  by  contractors.  Inventory 
accounting  must  include  accounting  controls  over  the  acquisition  and  issuance  of 
materials,  the  comparison  of  physical  inventories  and  records,  the  planning  for 
procurement  and  utilization,  and  effective  custody  of  the  materials. 
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KAR  3,  Accounting  for  Receivables  Including  Advances 


The  system  must  account  for  all  accounts  receivable  (all  debts  to  the  U.S. 
Government).  Accounts  receivable  shall  be  recorded  accurately  and  promptly  to 
provide  timely  and  reliable  financial  information.  Accounts  receivable  shall  be 
reduced  upon  collection  of  funds,  which  shall  be  deposited  as  expeditiously  as 
possible  and  recorded  in  the  accounting  records  or  when  offset  by  previously 
established  collateral.  For  uncollectible  amounts,  the  accounts  receivable 
balance  should  be  reduced.  An  allowance  for  uncollectible  accounts  must  be 
established  to  provide  full  financial  disclosure.  The  accounts  receivable  process 
should  include  documenting  the  efforts  made  to  collect  delinquent  debts. 

Advances  shall  be  recorded  as  assets  until  receipt  of  the  goods  or  services  or 
until  contract  terms  are  met.  Advances  must  be  promptly  recorded  and  subject 
to  accounting  controls  and  must  be  reconciled  to  general  ledger  control 
accounts. 


KAR  4,  Cost  Accounting 


Cost  accounting  must  involve  accounting  analysis  and  reporting  on  costs  of 
production  of  goods  or  services,  or  operation  of  programs,  activities,  functions, 
or  organizational  units.  Cost  accounting  shall  be  provided  in  the  accounting 
system,  as  necessary,  to  support  pricing  decisions,  productivity  improvement 
decisions,  performance  measurement,  efficiency  comparisons  of  like  activities, 
and  activities  of  the  Defense  Business  Operations  Fund.  Defense  Business 
Operations  Fund  accounting  shall  provide  an  effective  means  for  controlling  the 
cost  of  goods  and  services  produced  or  furnished  by  Defense  Business 
Operations  Fund  activities.  Cost  accounting  should  be  used  to  measure  the  costs 
of  specific  projects  and  processes  in  determining  operating  results.  All 
applicable  costs  should  be  accumulated  in  the  accounting  system. 


KAR  5,  Accrual  Accounting 


Accrual  accounting  must  recognize  the  accountable  aspects  of  financial 
transactions  or  events  as  they  occur.  Transactions  may  be  recorded  in 
accounting  records  as  they  occur  or  be  adjusted  monthly  to  the  accrual  basis. 
Accrual  accounting  should  be  used  to  meet  the  specific  needs  of  management 
and  Congress. 

Accrued  expenditures  and  revenues  must  be  recorded  only  when  supported  by 
prescribed  documentary  evidence  on  the  basis  of  initial  documentation  received 
and  must  be  adjusted  subsequently,  if  necessary,  upon  receipt  of  accurate 
documentation.  Examples  of  acceptable  initial  documentation  include  receiving 
reports,  bills  of  lading,  job  description  sheets,  certified  unpaid  invoices,  and 
journal  vouchers  showing  administrative  estimates  by  responsible  officials. 
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When  liabilities  are  incurred  as  work  is  performed  rather  than  when  deliveries 
are  made,  accruals  must  be  recorded  from  performance  reports  for  the  affected 
accounting  period.  Unpaid  personnel  compensation  and  benefits  that  have  been 
earned  as  of  the  end  of  the  pay  year  must  be  accrued  in  frill  or  in  part,  and 
should  be  recognized  annually  in  the  financial  statements.  Accrued  payroll  for 
the  salaries  and  wages  for  civilian  and  military  personnel  and  related  accounts 
must  be  recorded  and  reconciled  with  the  actual  payroll.  This  KAR  is 
applicable  to  all  accounting  systems. 


KAR  6,  Military  and  Civilian  Payroll  Procedures 


Payroll  systems  must  incorporate  controls  of  both  gross  and  net  payroll  amounts 
and  payroll  deductions  to  ensure  smooth  payroll  processing  action  and  to 
minimize  incorrect  payments.  Procedures  will  be  available  to  verify  that  only 
authorized  deductions  are  made  from  pay  and  that  all  deductions  are  supported 
by  proper  documentation.  Accounting  entries  for  authorized  deductions  from 
pay  must  be  verified.  Timely,  accurate,  and  complete  individual  and  subsidiary 
records  are  maintained  for  all  payroll  and  related  accounts.  The  general  ledger 
and  personnel  records  shall  be  reconciled  to  payroll  records. 


KAR  7,  System  Controls  (Fund  and  Internal) 


The  system  must  show  the  appropriations  and  funds  to  be  accounted  for  and  a 
description  of  the  accounting  entity's  proposed  fund  distribution  and  control 
process.  Administrative  fund  controls  must  verify  that  funds  are  used 
economically,  efficiently,  and  only  for  properly  authorized  purposes  and  prevent 
untimely  liquidation  of  obligations,  unmatched  expenditures,  and  undistributed 
disbursements. 

The  system  must  have  adequate  management  controls  to  prevent,  detect,  and 
correct  errors  and  irregularities  that  may  occur  within  the  system.  Separation  of 
duties  and  responsibilities  must  be  maintained  for  initiating,  authorizing, 
processing,  recording,  and  reviewing  transactions. 

Automated  systems  must  have  system  security  and  integrity  for  authorized 
processing  to  include  procedures  and  controls  that  protect  hardware,  software, 
and  documentation  from  physical  damage  and  unauthorized  access.  The  KAR  7 
is  applicable  to  all  accounting  systems. 


KAR  8,  Audit  Trails 


The  financial  transactions  on  accounting  system  processes  must  be  adequately 
supported  with  pertinent  source  documents.  All  transactions,  including  those 
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that  are  computer-generated  and  computer-processed,  must  be  traceable  to 
individual  source  records  maintained  in  the  accounting  system.  Audit  trails 
enable  tracing  a  transaction  from  its  source  to  the  resulting  record  or  report  and 
vice  versa.  A  key  test  of  the  adequacy  of  an  audit  trail  is  whether  tracing  the 
transaction  from  the  source  or  from  the  result  will  permit  verification  to  the 
amount  recorded  or  reported.  The  KAR  8  is  applicable  to  all  systems. 


KAR  9,  Cash  Procedures  and  Accounts  Payable 


The  system  shall  be  designed  to  verify  timely  payments  based  on  properly 
approved  disbursement  documents.  Payment  procedures  must  comply  with  the 
Prompt  Payment  Act.  Cash  discounts  should  be  taken  when  determined  to  be 
financially  advantageous  to  the  DoD.  Cash  shall  be  deposited  as  expeditiously 
as  possible  and  immediately  recorded. 

Accounts  payable  should  be  recorded  when  goods  or  services  are  received.  For 
items  manufactured  to  specifications,  the  accounting  system  shall  reflect  the 
appropriate  account  payable,  including  contract  retentions,  for  each  accounting 
period  based  on  contract  terms  or  on  reasonable  estimates  of  unbilled  contractor 
performance. 

Accounts  payable  for  services  performed  shall  be  determined  based  on 
performance  as  evidenced  by  payroll  records,  progress  billings,  or  other 
available  data.  Reasonable  estimates  of  the  cost  of  services  performed  before 
the  end  of  a  reporting  period  shall  be  made  for  annual  financial  reporting 
purposes  in  the  absence  of  invoices  or  other  available  data. 


KAR  10,  System  Documentation 


The  accounting  system  must  have  adequate  system  documentation,  including 
documented  interfaces  between  accounting  system  segments.  The  system  must 
also  adequately  document  the  functional  user's  accounting  requirements.  Such 
documentation  must  be  available  in  user  manuals  and  subsystem  specifications. 
The  detailed  documentation  must  be  comprehensive  and  shall  include  a 
combination  of  descriptions  of  processes;  flowcharts  and  narrative  description; 
diagrams;  basic  accounting  entries,  including  adjusting  and  closing  entries; 
illustrations  or  samples  of  source  documents  for  input;  and  reports.  It  shall  also 
include  management  controls  incorporated  within  the  accounting  system.  The 
documentation  must  demonstrate  conformance  with  DoD  requirements  for 
system  documentation  and  should  facilitate  maintenance  operations  and 
transaction  testing.  The  documentation  shall  have  enough  detail  so  that  testing 
of  the  system  could  cover  an  entire  transaction,  from  initial  authorization 
through  processing,  posting  to  the  accounts,  and  reporting.  The  system 
documentation  shall  be  created  to  be  easily  understood  by  computer  personnel 
and  system  accountants  assigned  to  develop  applicable  software  or  to  develop 
the  flow  of  the  accounting  review  process  and  shall  demonstrate  readily  to 
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users,  auditors,  and  evaluators  the  system's  conceptual  processes  and 
procedures.  The  documentation  should  indicate  the  mission,  organization, 
description,  objectives,  financial  management  requirements,  and  boundaries  of 
the  system.  The  KAR  10  is  applicable  to  all  accounting  systems. 


KAR  11,  System  Operations 


Accounting  system  operations  shall  be  adequately  planned  and  organized  to 
assure  that  financial  management  and  accounting  objectives  are  met  in  an 
economical  and  efficient  manner.  Financial  systems  shall  not  only  contain  all 
data  required  to  achieve  their  intended  purposes,  but  also  be  simple  to  operate. 

The  existing  and  planned  hardware  should  be  adequate  to  efficiently  process 
current  and  projected  future  transactions  and  should  be  sufficiently  compatible 
to  interface  effectively  with  other  systems. 

Detailed  procedures  for  system  operation  and  maintenance  must  be  established. 
Also,  periodic  system  reviews  must  be  performed  to  assure  that  the  system 
complies  with  accounting  system  requirements,  that  operating  problems  are 
promptly  identified  and  corrected,  and  that  enhancements  are  incorporated  as 
appropriate.  The  KAR  11  is  applicable  to  all  accounting  systems. 


KAR  12,  User  Information  Needs 


The  accounting  system  must  satisfy  users'  needs  of  quality,  accuracy, 
timeliness,  and  reliability  to  facilitate  management's  decisionmaking  process. 
The  system  shall  also  satisfy  users'  reporting  requirements,  particularly  as  they 
relate  to  end  of  the  month  reports.  The  KAR  12  is  applicable  to  all  systems. 


KAR  13,  Budgetary  Accounting 


The  accounting  system  shall  support  budget  formulation  and  budget  requests  and 
control  budget  execution.  Programming,  budgeting,  accounting,  reporting, 
classification,  and  coding  structure  should  be  uniform,  mutually  consistent,  and 
synchronized  with  the  organizational  structure  so  that  actual  activity  can  be 
compared  with  enacted  budgets,  to  support  future  budget  formulation  for  each 
activity.  Presidential,  congressional,  and  DoD  decisions  shall  be  recorded  in 
the  system,  which  shall  be  able  to  track  such  decisions.  The  system  shall  record 
budget  resources  at  the  appropriate  level  and  shall  account  for  all  budget  and 
appropriation  accounts  prescribed  by  DoD. 
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Questions  Needing  User  Input 


Table  F-l  summarizes  the  number  of  Review  Guide  questions  related  to  the  accounting 
functions  performed  by  DISA  WESTHEM.  The  footnotes  include  a  brief  description 
of  the  questions  relating  to  each  function  and  a  representative  question  taken  from  the 
Review  Guide. 


Table  F-l.  Review  Guide  Questions 
Requiring  User  Input  by  Accounting  Function 


No.  of  Questions 
12 
16 
10 
17 
55 

Questions  concern  accounting  policies,  procedures,  controls,  and  selected  tests 
that  ensure  only  authentic  and  approved  accounting  transactions  are  recorded. 
Sample  question.  Are  key  duties  and  responsibilities  for  authorizing, 
processing,  recording,  reviewing  transactions,  issuing  or  receiving  assets, 
inventory  control,  expenditure  processing,  assigned  to  separate  individuals? 

2Questions  cover  accounting  policies,  procedures,  controls,  and  selected  tests 
that  ensure  the  accuracy  and  completeness  of  accounting  transactions. 

Sample  question.  Do  you  record  in  your  financial  records  the  value  for  property 
and  equipment  acquired  by  transfer  without  reimbursement  at  the  transferor's 
recorded  acquisition  cost  minus  accumulated  depreciation;  plus  transportation, 
installation,  and  other  costs  of  obtaining  the  property  into  use? 

3Questions  cover  accounting  policies,  procedures,  controls,  and  selected  tests 
that  ensure  financial  transactions  are  input  into  the  proper  account  or 
subaccount. 

Sample  question.  Are  repair  and  maintenance  costs  incurred  to  keep  property  in 
satisfactory  operating  condition  accounted  for  as  current  operating  costs? 

Questions  may  cover  accounting  policies,  procedures,  and  controls,  but 
primarily  are  concerned  with  control  tests  that  verify  the  accuracy, 
completeness,  and  integrity  of  accounting  transactions. 

Sample  question.  Are  inventories  periodically  verified  and  accounting  records 
adjusted  accordingly? 


Accounting  Function 
Authorization  function1 
Recording  function2 
Classification  function3 
Analysis  function4 
Total 
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Table  F-2  classifies  each  Review  Guide  question  related  to  a  DISA  WESTHEM 
accounting  function. 


Table  F-2.  Review  Guide  Questions  Requiring  User  Input 


KAR1 

User  Accounting  Function2 

Question 

Numbers 

2 

Recording  Function 

:  '  3,6,9 

.  Classification  Function  * 

2,  4,  5,  a  * 

Analysis  Function 

7,  10 

3 

Authorization  Function 

Recording  Function 

2,  8,9 

4 

..  .  Recording  Function  11 

4  V 

Classification  Function 

iiiiiiliiiiBiiiiiiiiiii 

Recording  Function 

m- 

Classification  Function 

4 

Authorization  Function 

15,21 

7 

Authorization  Function 

Recording  Function 

5,9 

Classification  Function 

2,3 

Analysis  Function 

4,8 

■;  8 

.  Authorization  Function 

|g  2,3  || 

i 

Authorization  Function 

Recording  Function 

1,  15 

Classification  Function 

3 

Analysis  Function 

5,  7,  10,  16, 

17,  18,  19,  21 

ill  •••• 

Authorization  Function 

#11 

.  Recording  Function 

:  io 

Analysis  Function 

9  ; 

12 

Classification  Function 

i 

Analysis  Function 

2,  7,  8,  10 

[,i  ;i| .  '2; 

1  Recording  Function 

.32  r  P': 

^e  key  accounting  requirements  are  described  in  Appendix  E. 


2For  each  key  accounting  requirement,  we  categorized  the  review  questions,  using  the 
accounting  system  function  performed  by  users  as  described  in  DoD  Financial 
Management  Regulation  7000. 14-R,  volume  1,  May  1993. 
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Questions  Needing  System  Documentation 


Table  G-l  summarizes  the  number  of  Review  Guide  questions  requiring  supporting 
evidence  for  affirmative  answers.  The  footnotes  include  a  brief  description  of  the 
questions  relating  to  each  system  control  and  a  representative  question  taken  from  the 
Review  Guide. 


Table  G-l.  Review  Guide  Questions 
Requiring  Accounting  System  Documentation 


_ System  Controls 

System  capability1 
System  control  procedure2 
System  output3 
System  security  controls4 
User  records5 
User  control  procedure6 
Total 


No.  of  Questions 
25 
25 
6 
5 

14 

13 

88 


1Questions  concern  accounting  capabilities  of  the  automated  system. 

Sample  question.  Does  the  system  documentation  describe  the  system  objectives 
and  include  diagrams  of  modules  or  accounting  processing  cycles  with 
explanatory  notes? 

Questions  cover  automated  procedural  controls  for  accounting  information  in 
the  automated  system. 

Sample  question.  Does  the  system  employ  effective  procedures  to  prevent 
duplicate  payments? 

Questions  cover  specific  output  documents  of  the  automated  accounting 
system. 

Sample  question.  Does  the  component  maintain  reporting  schedules  and  a  list 
of  system-generated  reports,  the  report  due  dates,  and  the  report  recipients? 

Questions  cover  security  controls  built  into  the  automated  accounting  system. 
Sample  questions.  Are  files  adequately  protected  from  loss  or  unauthorized 
changes  while  being  accessed  and  maintained? 

Questions  cover  various  aspects  of  transactions  recorded  by  system  users. 
Sample  question.  Do  you  record  the  acquisition  and  construction  of  capital 
assets  at  cost  plus  the  costs  of  construction,  transportation,  installation, 
handling,  and  storage  costs  and  arty  related  costs  of  obtaining  and  preparing 
the  property? 

6Questions  cover  system  user  accounting  controls. 

Sample  question.  Do  audit  trails  exist  from  source  documents  to  financial 
statements  and  vice  versa? 
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Table  G-2  classifies  each  Review  Guide  question  related  to  system  controls  as 
determined  by  our  analysis. 


Table  G-2.  Review  Guide  Questions  Requiring  Accounting  System 

Documentation 


KAR1 

Review  Category2 

Question 

Numbers 

1 

System  capability 

11  System  control  procedure  | 

.  System  output 

1,  2, 15,  20 

.  v-v  7 

aigiiiiii 

i 

System  capability 

User  records 

7  . 

2,  3,  4,  5,  6,  8, 

9 

l 

User  records  ... 
jyHI  User  control  procedure 

•ri 

4 

System  capability 

System  procedure 

1,  2,  3,  11 - 

8 

,5  ?  I;  0  '  V- 

...  User  control  procedure  , 

ISSi 

6 

System  capability 

System  procedure 

System  output 

User  records 

User  control  procedure 

19 

2,  5,  6,  8,  10, 

11,  14,  17 

4 

2 

15,  21 

7 

.  System  capability 
:  :  ;  System  procedure  ; 

User  records  ; 

User  control  procedure 

..  .  %  2,  3,  7, 14 

M,  17, 18,  19, 

•1  21,22,23 

8,  10 

8 

System  procedure 

User  control  procedure 

1,4  . 

2,3 

See  footnotes  on  next  page. 
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KAR1 

Review  Category2 

Question 

Numbers 

|t:  9  ; 

System  capability 

.  23 

System  procedure 

User  records 

11  1,7,9  Jillfitl: 

User  control  procedure  . 

9,  20 

10 

System  capability 

5,  6,  8,  9 

System  procedure 

7 

||  11  • 

System  capability 

6 

System  procedure 

-  *=•?, s  • . 

System  security 

10,  4|y  1:2,  -13- 

12 

System  capability 

6 

System  procedure 

10 

System  output 

1,2 

System  security 

4 

|Q  ;  13  j 

:  System  capability  .......... 

||  jj  2,  3,4,6 

1The  key  accounting  requirements  are  described  in  Appendix  E. 

2For  each  key  accounting  requirement,  we  categorized  the  questions  based  on  our 
analysis  of  the  type  of  documentation  required  by  the  question. 
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Questions  Needing  Review  Documentation 


Table  H-l  summarizes  the  number  of  Review  Guide  questions  requiring  supporting 
evidence  for  affirmative  answers.  The  footnotes  include  a  brief  description  of  the 
questions  relating  to  each  review  control  and  a  representative  question  from  the  Review 
Guide. 


Table  H-l.  Review  Guide  Questions 
Requiring  Review  Documentation 


Type  of  Review  Control 
Account  reconciliations1 
Account  analyses  and  comparisons2 
Control  testing3 
Other  reviews* 

Total 


No.  of  Questions 
6 

4 
9 

5 
24 


Questions  concern  accounting  reviews  to  determine  whether  related  account 
balances  agree  or  whether  actual  assets  support  account  balances. 

Sample  question.  Are  subsidiary  accounts  reconciled  to  control  accounts? 

Questions  concern  reviews  to  determine  the  propriety  of  account  balances  and 
the  propriety  of  accounting  entries  supporting  account  balances. 

Sample  question.  Are  abnormal  account  balances  identified,  investigated,  and 
corrected  in  a  timely  manner? 

3Questions  concern  specific  tests  designed  to  determine  whether  accounting 
transaction  and  processing  controls  are  adequate. 

Sample  question.  Did  acceptance  testing  cover  the  entire  flow  of  transactions 
from  initial  authorization  through  processing,  posting  to  the  accounts,  and 
reporting? 

Questions  cover  reviews  not  included  in  the  above  categories. 

Sample  question.  Is  the  propriety  of  individual  user  and  terminal  authority 
levels  periodically  reviewed? 
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Table  H-2  classifies  each  Review  Guide  question  related  to  review  controls. 

Table  H-2.  Review  Guide  Questions  Requiring  Review  Documentation 


KAR1 

Review  Documentation  Category2 

Question 

Numbers 

ItgiWg  if 

Account  reconciliation  : 

Account  analyses  and 

6,9 

Y-:.:-"  comparisons  :  f';; 

10 

Control  testing 

i 

Account  reconciliation 

10 

4 

•  ••  Account  analyses  and  •  • 

g  io'g-.  'g  • 

comparisons 

Other  reviews 

1 1 9  lii! 

5 

Account  reconciliation 

6 

g  .  6  glg-3 

Account  reconciliation  .  . 

:|:r;;;|§,'23, 24; 

7 

«  b  (aw  *  i 

"  4, 15 

8 

Control  testing  . 

g-3:  . 

9 

Control  testing 

10 

Other  reviews 

18 

tlS-Wg'ftSl 

Control  testing 

|  2,  3,  4 

11 

Control  testing 

15  . 

Other  reviews 

9,  14 

||  12  g: 

Account  analyses  and 
comparisons 

ilillf 

Other  reviews 

■lllliSBIlii 

1The  key  accounting  requirements  are  described  in  Appendix  E. 


2For  each  key  accounting  requirement,  we  categorized  the  questions  based  on  our 
analysis  of  the  type  of  review  documentation  required  by  the  question. 
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Appendix  I.  Summary  of  Potential  Benefits 
Resulting  From  Audit 


Recommendation 

Reference  Description  of  Benefit  Type  of  Benefit 


1. 

2. a. 


2.b. 

2.c. 


3. 


Management  Control.  Improves  the 
reliability  and  quality  of  annual 
reviews. 

Management  Control.  Provides 
DFAS  and  DISA  WESTHEM 
employees  necessary  skills  to 
perform  their  responsibilities  in 
performing  annual  reviews. 

Management  Control.  Improves 
accuracy  and  usefulness  of  annual 
accounting  system  reviews. 

Management  Control.  Strengthens 
the  annual  review  process  and 
improves  the  reliability  and  quality 
of  annual  reviews. 

Management  Control.  Results  in 
DISA  WESTHEM  personnel  being 
adequately  trained  to  participate  in 
annual  reviews. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller),  Washington,  DC 


Department  of  the  Navy 

Auditor  General,  Naval  Audit  Service 


Defense  Agencies 

Defense  Finance  and  Accounting  Service,  Arlington,  VA 

Defense  Finance  and  Accounting  Service,  Richmond  Detachment,  Richmond,  VA 
Defense  Finance  and  Accounting  Service,  Indianapolis,  IN 
Defense  Finance  and  Accounting  Service,  Columbus,  OH 
Defense  Finance  and  Accounting  Service,  Cleveland,  OH 
Defense  Finance  and  Accounting  Service,  Pensacola,  FL 
Defense  Accounting  Office,  Fort  Ritchie,  MD 
Defense  Information  Systems  Agency,  Arlington,  VA 

Defense  Information  Systems  Agency,  Western  Hemisphere,  Denver,  CO 

Defense  Megacenter,  Dayton,  OH 

Defense  Megacenter,  Chambersburg,  PA 

Defense  Megacenter,  Mechanicsburg,  PA 

Information  Processing  Center,  Pensacola,  FL 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  to  the  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence) 

Assistant  to  the  Secretary  of  Defense  (Public  Affairs) 

Director,  Defense  Logistics  Studies  Information  Exchange,  Under  Secretary  of  Defense 
for  Acquisition  and  Technology. 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 

Director,  Defense  Information  Systems  Agency,  Western  Hemisphere 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
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Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International 
Affairs  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Part  HI  -  Management  Comments 


Defense  Finance  and  Accounting  Service 
Comments 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 

1  93 1  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22240-5291 

AN  2  7  1935' 


MEMORANDUM  FOR  DIRECTOR,  READINESS  AND  OPERATIONAL  SUPPORT 
DIRECTORATE,  INSPECTOR  GENERAL,  DOD 

Subject:  Revised  Response  to  DoDIG  Draft  Report,  “Management 

Control  Program  at  Defense  Information  Systems  Agency, 
Western  Hemisphere,"  dated  April  11/  1995,  (Project  No. 
4RE-2005 . 01) 


In  a  memorandum  dated  May  12,  1995,  subject  as  above,  we 
provided  comments  as  requested  in  your  memorandum  dated  April  11, 
1995,  to  recommendations  directed  to  the  Defense  Finance  and 
Accounting  Service  (DFAS)  in  the  subject  report.  After  reviewing 
our  previous  comments,  I  determined  that  our  comments  warranted 
revision.  At  a  meeting  on  June  13,  1995,  between  representatives 
of  your  office  and  the  DFAS,  we  discussed  the  draft  revised  DFAS 
comments.  Based  on  those  discussions,  our  revised  comments  are 
attached. 

My  point  of  contact  is  Mr.  William  J.  deBardelaben.  He  may 
be  contacted  on  (703)  607-1581/79. 


DFAS -HQ /AD 


'tfdward^.  Harris 

Deputy  Director  for  Business  Funds 
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Revised  Response  to  DoDIG  Draft  Report,  "Management  Control 
Program  at  Defense  Information  Systems  Agency,  Western 
Hemisphere,"  dated  April  11,  1995,  (Project  No.  4RE-2005.01) 


RECOMMENDATION  i:  Director,  Defense  Finance  and  Accounting 
Service  and  the  Director,  Defense  Information  System  Agency, 
Western  Hemisphere  establish  a  Memorandum  of  Agreement  to 
provide  the  specific  responsibilities  for  system  managers 
and  system  users  in  performing  the  FY  1996  and  subsequent 
annual  reviews. 

DFAS  COMMENTS:  Nonconcur.  DFAS  does  not  concur  with  the 
need  for  a  Memorandum  of  Agreement  with  system  users.  The 
requirement  that  system  managers  and  users  participate  in 
the  completion  of  annual  systems  reviews  is  stated  in  the 
Defense  Finance  and  Accounting  Service  (DFAS)  Systems 
Manager /User  Review  (SM/UR)  Guide  and  in  the  DoD  Financial 
Management  Regulation.  FMR  7000. 14-R,  Chapter  3,  Volume  1. 
DFAS,  however,  will  reinforce  these  guidances  by  requiring 
that  selective  “users,"  where  appropriate,  be  included  in 
.each  systems  review.  Additionally,  user  participation  in 
systems  reviews  will  also  be  stated  in  the  transmittal 
memorandum  accompanying  the  SM/UR  Guide.  Appropriate  user 
participation  will  be  required  for  interim  migratory  and 
migratory  systems  reviews  and  considered  for  selected  legacy 
systems  reviews. 

RECOMMENDATION  2:  Director,  Defense  Finance  and  Accounting 
Service: 


a.  Implement  the  requirements  of  DoD  Directive 
5010.38,  "Internal  Management  Control  Program,"  April  14, 
1987,  by  establishing  a  training  program  on  the  purpose, 
objective,  scope,  and  performance  of  annual  accounting 
system  reviews  for  the  system  managers  of  the  Standard 
Financial  System,  the  Defense  Business  Management  System, 
and  the  Industrial  Fund  Accounting  System,  and  for  the 
Defense  Information  System  Agency,  Western  Hemisphere  system 
users. 


b.  Implement  the  requirements  of  DoD  Directive 
5010.38,  "Internal  Management  Control  Program,"  April  14, 
1987,  and  DoD  Financial  Management  Regulation.  FMR  7000.14- 
R,  Volume  1,  May  1993,  by  specifying  in  the  FY  1996 
Systems  Manager/User  Review  Guide  that  system  managers  must 
retain  system  and  review  documentation  supporting 
affirmative  responses  to  Review  Guide  questions. 
Documentation  must  evidence  that: 

o  accounting  system  controls  are  in  place,  and 
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o  periodic  control  testing  was  performed  to 
demonstrate  that  controls  were  working. 

c.  Direct  system  managers  to  consider  the  results  of 
audits  and  other  related  evaluations  of  the  accounting 
system  controls  in  completing  the  FY  1996  System  Manager/ 
User  Review  Guide. 

DFAS  COMMENTS  TO  RECOMMENDATION  2 .a.:  Partially  concur. 

DoD  Directive  5010.38,  "Internal  Management  Control 
Program,"  April  14,  1987,  is  not  the  only  reference  for  this 
issue.  DoD  Directive _5010 ..38 ,  -paragraph  D.  5 .  states: 
"Specific  policies  for  the  evaluation  of  Internal  Management 
Controls  that  are  an  integral  part  of  accounting  systems  are 
prescribed  in  DoD  Accounting  Manual,  7220. 9-M,  Chapter  12." 
DoD  7220. 9-M,  Chapter  12  was  replaced  by  the  DoD  Financial 
Management  Regulation,  FMR  7000. 14-R,  Volume  1,  Chapter  3, 
"Accounting  System  Conformance,  Evaluation,  and  Reporting." 
Suggest  that  the  reference  to  DoD  Directive  5010.38  be 
supplemented  with  a  reference  to  the  FMR  7000. 14-R. 

Interim  guidance  is  issued  in  the  annual  DFAS  SM/UR  Guide 
and  during  the  annual  DFAS  FMFIA  Section  4  Conference  held 
for  all  DoD  Components.  The  FMR  7000. 14-R  is  being  revised 
to  reflect  interim  revisions  and  new  and  emerging  OMB 
guidance  resulting  from  the  revised  OMB  Circular  A- 12 3  which 
is  scheduled  to  be  finalized  midsummer  1995. 

Current  OMB  circulars  and  DoD  directives  place  the 
responsibility  for  compliancy  of  FMFIA  systems  on  the 
individual  systems  managers,  and  require  that  annual  FMFIA 
self-evaluations  be  based  on  the  collective  knowledge  of  the 
managers  gained  from  the  daily  operation  of  agency  programs 
and  systems.  Therefore,  systems  managers  are  responsible 
for  assigning  knowledgeable,  experienced,  and  fully 
qualified  individuals  to  complete  the  systems  reviews. 

The  DFAS  SM/UR  Guide  is  designed  so  that  qualified 
accountants  should  be  able  to  understand  and  respond 
properly  to  all  requirements  and  questions.  Should 
questions  arise,  DFAS  Headquarters  and  Center  points-of- 
contact  have  been  provided.  At  the  annual  DFAS  FMFIA 
Section  4  Conference,  training  in  the  execution  of  systems 
reviews  is  provided  to  all  participants.  However,  not  all 
DoD  Components  participate  in  the  annual  conferences; 
neither  do  all  DoD  Components  have  FMFIA  Section  4 
coordinators.  For  those  systems  managers  and  selective 
"users"  that  do  not  participate  in  the  annual  conference, 
the  appropriate  DFAS  Center  will  provide  points-of-contact 
to  assist  and  provide  guidance  as  required. 

DFAS  COMMENTS  TO  RECOMMENDATION  2.b.S  Concur.  The  SM/UR 
Guide  does  assist  managers  in  performing  the  self-assessment 
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and  does  provide  the  means  to  document  the  review  process. 
However,  in  the  FY  1996  SM/UR  Guide,  we  will  add  the 
requirement  that  systems  managers  retain  documentation 
supporting  their  reviews  used  to  prepare  or  support  answers 
provided  in  the  systems  review. 

DFAS  COMMENTS  TO  RECOMMENDATION  2.C.S  Concur.  The  SM/UR 
Guide  does  require  systems  managers  to  examine  the  results 
of  prior  reviews,  evaluations  or  audits  and  to  consider  any 
applicable  audit  finding  or  recommendation  in  the  systems 
review  process.  Also,  copies  of  audit  findings  covering 
.potential  FMFIA  weaknesses  .are  .forwarded  by  DFAS  to  the 
appropriate  FMFIA  coordinator  for  consideration  in  their 
current  year  FMFIA  Program. 
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This  report  was  prepared  by  the  Readiness  and  Operational  Support 
Directorate,  Office  of  the  Assistant  Inspector  General  for  Auditing,  DoD. 

Thomas  F.  Gimble 
Salvatore  D.  Guli 
Mary  Lu  Ugone 
John  D.  Donnelly 
Jonathan  M.  Rabben 
Timothy  E.  Moore 
Kathleen  Fitzpatrick 
Nancy  C.  Cipolla 
Cristina  Maria  H.  Giusti 
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